The LTL Freight Quotes WordPress plugin before version 4.2.19 does not sanitize or escape data submitted through an unauthenticated endpoint before storing the values and later rendering them in an administrative interface. An attacker can inject arbitrary markup or JavaScript into the shipping rules payload, which is persisted in the database. When any administrator views the corresponding admin page, the malicious input is executed in the administrator's browser session, providing full access to the user context.

The vulnerability affects installations of the LTL Freight Quotes plugin for WordPress where the plugin version is prior to 4.2.19. No specific vendor is listed; the product is identified as the LTL Freight Quotes WordPress plugin. All deployments using any of the affected versions are at risk.

The threat does not rely on privileged credentials to inject the payload—any user can craft a request to the shipping rules endpoint. The stored payload is rendered only when an administrator loads the page, so the impact is limited to administrative sessions. With a CVSS score of 8.8, the vulnerability is a classic stored cross‑site scripting flaw, which can be used to hijack sessions, deface the site, or exfiltrate sensitive data. No EPSS data or KEV listing is available, but the lack of mitigation in the current plugin version indicates that the vulnerability would likely be actively exploited. Administrators should treat this as a high‑priority threat and apply the fix promptly.